Spaces:
Running
Running
| """Server-owned hosting and loopback policy; forwarding headers confer no trust.""" | |
| from __future__ import annotations | |
| import ipaddress | |
| import os | |
| from starlette.requests import Request | |
| from sinetti_services.hosting import hosted_runtime | |
| def local_loopback_request(request: Request) -> bool: | |
| if hosted_runtime() or os.environ.get("APP_BACKEND", "").strip().lower() != "local": | |
| return False | |
| peer = request.client.host if request.client else "" | |
| host = request.url.hostname or "" | |
| try: | |
| peer_loopback = ipaddress.ip_address(peer).is_loopback | |
| host_loopback = host.lower() == "localhost" or ipaddress.ip_address(host).is_loopback | |
| except ValueError: | |
| return False | |
| return peer_loopback and host_loopback | |